Privacy Policy

Last updated: 15 August 2026 · Version 6

This policy explains what personal data revelavid processes, why, and on what legal basis, as required by the EU General Data Protection Regulation (GDPR). It applies to the revelavid desktop application. In short: the app itself collects no personal data, and nothing you create is ever sent anywhere — except the optional video showcase described in Section 9, which only ever activates when you choose to publish a video.

1. Data controller

The controller for the processing described in this policy is revelavid. Contact: legal@revelavid.com · github.com/revelavid/revelavid. Legal identity and registered address are listed in the Imprint.

2. Data we do not collect

revelavid has no telemetry, no analytics, no crash reporting, and no automatic update check. It does not use tracking cookies or advertising identifiers, and it does not knowingly collect any personal data from you. Your videos, images, audio, and videos stay on your device. Nothing you create is transmitted to us or to any third party, with the sole exception of the optional video showcase (Section 9) you explicitly choose to use.

3. Data stored locally on your device

• Your video files (.json) and their assets are stored wherever you choose to save them on your computer. We never see them.
• App settings and a recent-files list (including the paths of files you opened) are stored in your operating system's application-data folder so the app can remember your preferences. This data never leaves your device.
• Your acceptance of this policy is recorded locally, together with a version number and timestamp, so the dialog is not shown on every launch and so we can demonstrate your consent if ever required. This record is stored only on your device.

Because this data is stored locally and is not transmitted to us, it is not "processed" by us within the meaning of the GDPR. Where it contains personal data (for example, file names that reveal personal information), it remains under your sole control.

4. Local processing

Screen recording, audio recording, video encoding, and all other processing are performed locally on your computer using the bundled FFmpeg. Nothing you create is uploaded to the internet. The only exceptions are the optional services you choose to use — the Pixabay photo search described in Section 8 and the video showcase described in Section 9 — each of which shares only the data described in its section.

5. Permissions (microphone and screen)

When you record audio or your screen, the operating system asks you to grant microphone or screen-capture access. This processing is carried out only to provide the feature you requested, based on your consent (Art. 6(1)(a) GDPR), and is controlled by your operating system. You can revoke the permission at any time through your operating system's settings. Revoking it does not affect the lawfulness of processing carried out before the revocation.

6. Information you voluntarily provide to us

If you contact us with a support question, we will use the email address you write from and the contents of your message solely to respond to your request (Art. 6(1)(b) GDPR — the steps taken at your request before entering into a contract, and our legitimate interest in providing support). Our support mailbox is operated on our behalf by Ledl.net GmbH & Co. KG ("alldomains.hosting"), a sub-processor (see Section 11). We keep support correspondence only for as long as needed to resolve your request and, where relevant, to comply with legal obligations.

If you join our newsletter, we will process your email address to send you the newsletter based on your consent (Art. 6(1)(a) GDPR). Newsletters are sent through our sub-processor Brevo (Sendinblue SAS, doing business as Brevo), which stores subscriber data on servers within the European Union under a data processing agreement (Art. 28 GDPR). Registration uses a double opt-in, and newsletters may contain a web beacon to measure opening and click rates for statistical purposes. You can withdraw your consent at any time by following the unsubscribe link in any newsletter or by contacting us; the withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We never sell personal data and do not use it for advertising or profiling. We do not share email addresses or message contents with any third party except as required to operate the services you request (for example, the email and newsletter service providers listed in Section 11) and where permitted by law.

7. The built-in music library

revelavid's Music library (the "Music library…" button in the inspector) downloads royalty-free music into your app. The tracks are a curated selection of Kevin MacLeod's incompetech catalog, licensed under CC BY 4.0, and are served directly by revelavid from our own servers — no request is ever sent to incompetech or any other third party.

No personal data is processed for the music library. The music files are served from our virtual private server, which is hosted by netcup GmbH (a sub-processor, see Section 11). Downloads are anonymous HTTP requests to that server; we do not read, store, or log your IP address, we use no cookies or tracking, and the music endpoints carry no analytics. Because no data about you is shared with any content service, this feature requires no separate consent. The catalog is cached locally in the app's data folder so it also works offline after the first load, and downloaded tracks are stored locally on your device in the app's data folder, shared across all your videos.

7.1 Music content license

The music is provided under the Creative Commons CC BY 4.0 license, which permits use, including commercial use, provided you give appropriate credit. When you insert a track, revelavid pre-fills the "Music credit" field with the required attribution; credits are burned into the exported video while that music plays when you leave the credit toggle enabled.

8. The built-in image search (Pixabay)

revelavid includes an optional, built-in search for royalty-free photos, provided by Pixabay (pixabay.com). It activates only when you open the Photos tab of the image chooser, and on first use we ask for your consent before anything is sent.

8.1 Data shared with Pixabay

When you use the photo search, the following is sent to Pixabay, which operates its service independently under its own privacy policy:

• Your IP address. An IP address is a number assigned to your device that is required to use the Internet; every website you visit receives your IP address. When you use the photo search, Pixabay receives your IP address, exactly as when you visit its website directly.
• Your search queries. The search terms you type are sent to Pixabay so it can return matching photos.
• Downloads. When you choose a photo, revelavid downloads it from Pixabay's servers into your video. The download request reveals your IP address to Pixabay and its content delivery network.

This processing is based on your consent (Art. 6(1)(a) GDPR). Consent is asked for the first time you open the Photos tab, with a plain-language explanation of the IP address sharing. You can decline ("Not now"), in which case the search stays disabled. Granting consent is recorded locally (see below) and you will not be asked again unless this policy changes.

8.2 Local storage and how to revoke

Your consent record (a version number and timestamp) is stored only on your device, in the app's data folder. Search results are cached locally for 24 hours, as required by Pixabay's API terms, so repeating a search does not re-contact the service unnecessarily. Photos you choose are stored in your video's revelavid-assets folder like any other media.

To revoke your consent, contact us at legal@revelavid.com or delete the file pixabay-consent.json from the app's data folder. Revocation stops future searches but does not affect the lawfulness of processing carried out before the revocation.

8.3 Photo content license

Photos are provided under the Pixabay Content License, which permits free use, including commercial use, but does not allow the standalone resale of unmodified content. Pixabay does not warrant model or property releases, so you are responsible for checking that your use (for example, commercial use or photos showing recognizable people or trademarks) is permitted.

9. Video showcase (hosted videos)

revelavid's video showcase lets you publish an exported video behind a public page and an embed code (the "Publish to showcase…" button after exporting). It is optional and only ever activates when you choose to publish a video.

9.1 Account (email + one-time code)

Publishing requires a revelavid account. We ask for your email address at publish time and send you a 6-digit one-time code; you enter it to sign in. This processing provides the feature you requested and is based on your consent (Art. 6(1)(a) GDPR). The code expires after 10 minutes and is stored only as a hash. We do not set tracking cookies, and we do not share your email with anyone except the email provider that delivers the code to you.

9.2 Session token

After sign-in, your device stores an encrypted session token (via your operating system's secure storage) so you stay signed in for up to 90 days without being asked again. It is used solely to authenticate your publish requests and is stored on your device; you can sign out at any time from the publish dialog.

9.3 The video

When you publish, the exported MP4 is uploaded to revelavid's hosting provider (OVH object storage in the EU) so it can be served on the public page. The upload reveals your IP address to that provider, exactly as any website visit does. Two modes exist:

• Demo publish (available to everyone) is private to your account, visible only when you are signed in, and is automatically deleted 60 minutes after publishing. Publishing again replaces the previous demo video.
• Pro publish (a paid Pro feature) goes live on a public page with an embed code anyone can use. Pro videos are published immediately and reviewed by a human moderator afterwards; content that violates our Terms is removed and the publisher is notified. See the Terms for what content may be published.

9.4 Retention and deletion

Your account (your email) and your hosted videos are retained until you ask us to delete them, the video is removed for a Terms violation, or the account becomes inactive. Demo videos are deleted after 60 minutes as described above. To delete your account or a hosted video, contact us at legal@revelavid.com.

9.5 View analytics and bandwidth protection

To count views and to protect our hosting against excessive bandwidth use, the public video page and the embed player send us a small event ("play" / "ended") when a video is played. This processing is necessary for our legitimate interests (Art. 6(1)(f) GDPR): running a reliable service and keeping hosting costs under control.

• No personal identifiers are stored. We never store your IP address, browser, or referring page. To count distinct daily viewers we derive a one-way, salted hash from the viewer's IP address and the date; because the date is part of the hash it changes every day, cannot be reversed, and cannot be used to recognise the same viewer on a different day. These hashes are deleted after 48 hours. We only keep daily aggregate counts per video.
• Hosting request logs. Our hosting provider (OVH) records automated logs of requests to the video storage (including IP addresses and timestamps) so that we can monitor bandwidth and stop serving a video that exceeds its bandwidth allowance. These logs are stored in the EU and deleted after 30 days.
• Web-server logs. The showcase website, the embed player and the analytics beacon run on our virtual private server, hosted by netcup GmbH (see Section 11). Its web server keeps short-term automated access logs (IP addresses, timestamps, requested URLs) that are used solely to operate, protect and troubleshoot the service; the media access log is rotated and deleted after about seven days.
• Bandwidth caps. A video or account that exceeds its bandwidth allowance for a day or a month is temporarily made unavailable, and automatically returns once the window resets. We may email the publisher and the moderator as usage approaches a limit.

11. Service providers (sub-processors)

Where we use a provider to process personal data on our behalf, we have a data processing agreement with it (Art. 28 GDPR) and it only processes data for the purposes described in this policy. The following providers are currently engaged:

• netcup GmbH (Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany) — VPS hosting. Role: operates our virtual private server, on which the showcase website and embed player, the SQLite database of accounts and videos, the music-library downloads, the view-analytics beacon, and the bandwidth enforcement run. Data: account and video metadata, pseudonymised view analytics, and short-term web-server logs (IP addresses and timestamps). Location: Germany (EU).
• OVHcloud (OVHcloud SAS, Roubaix, France) — EU object storage. Role: hosting your published videos and their access logs. Data: the video files, IP addresses and request metadata in the access logs. Location: EU (France). We only use OVHcloud's EU region, so your data is not transferred outside the EEA for this purpose.
• Brevo (Sendinblue SAS, doing business as Brevo, 17 rue Salneuve, 75017 Paris, France) — newsletter dispatch. Role: sending the newsletter you subscribed to. Data: your email address, optional name and consent records. Location: EU (France).
• alldomains.hosting (Ledl.net GmbH & Co. KG, Wamslerstraße 8, 81829 München, Germany) — support email hosting. Role: operating our support mailbox. Data: the email address and contents of the support correspondence you send us. Location: Germany (EU).

Our email providers are also processors for the purpose of delivering emails to you, such as the login codes described in Section 9.1. You should review each provider's own privacy policy for details of its processing.

12. International data transfers

We do not transfer your personal data to us or to any third party ourselves. The sub-processors described in Section 11 — netcup GmbH (Germany), OVHcloud (EU region), Brevo (France) and alldomains.hosting (Germany) — all store data within the European Union, so the processing described in this policy does not involve a transfer of personal data outside the EEA. When you contact a third-party service (as described above), that service may be located outside the European Economic Area and may process your IP address in countries that do not have an adequacy decision from the European Commission. We are not a party to those transfers; you should review the privacy policy of each service you use. Any future processing by us that involves a transfer outside the EEA would be made only with appropriate safeguards (for example, standard contractual clauses).

13. Retention

We do not collect personal data from the app itself. The data we do hold comes from the services you choose to use and is retained as described there: support correspondence and newsletter subscriber data held by Brevo and alldomains.hosting (Section 6), consent records (Sections 8 and 9.1), showcase accounts and videos (Section 9), short-term web-server logs (about seven days, Section 9.5), and the anonymous view analytics and OVH request logs (Section 9.5). We delete or anonymise this data as soon as it is no longer needed.

14. Your rights

You have the following rights in relation to any personal data we may process about you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure ("right to be forgotten", Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise any of these rights, contact us at legal@revelavid.com. We will respond within one month. In practice, since the app itself does not transmit personal data to us, these rights most often concern the support and newsletter data described in Section 6 and the showcase account and hosted videos described in Section 9.

15. Automated decision-making and profiling

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects concerning you (Art. 22 GDPR).

16. Changes to this policy

If we change how we process personal data, we will update this policy and, where required, ask you to accept the updated version again when you launch the app. The current version is always shown in the app's Help menu.